Dethernety vs TSpec
Dethernety
dether.netTSpec
github.comSide by side
| Figure | Dethernety | TSpec |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | Yes | — |
| Open source | Yes | — |
| Web | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 5 | 0 |
| Spec score · Threat Modeling Software | 8.7 (#1) | 6.2 (#21) |
| Intended users | The maker describes the GUI for security teams and the CLI for DevOps teams, with the CLI supporting CI/CD automation and threat-model-as-code. | The project describes itself as designed specifically for TypeScript developers. |
| License | The public repository is licensed GNU Affero General Public License version 3.0, AGPL-3.0-only. | The repository identifies the project as MIT licensed. |
| Purpose | Dethernety is a graph-native threat modeling platform for building and analyzing architecture models. | TSpec is a TypeScript-first testing framework for testing TypeScript applications. |
Plans
Dethernety
- Open SourceFree
- BYODtPriced on request
- BYODt Team — 5 or 20 seatsPriced on request
- EnterprisePriced on request
- Hosted SaaSPriced on request
In their own words
Dethernety
Dethernety is an open-source threat modeling platform that represents architecture as a graph for building and analyzing system models. Teams can create and explore models in a browser, from code, or from reports. Analysis follows the architecture graph to examine attack paths, blast radius, and residual risk. Exposures map to MITRE ATT&CK techniques and controls to D3FEND countermeasures for coverage-gap analysis. The platform has JavaScript and TypeScript modules for design, analysis, and issues, plus an OPA/Rego policy engine. Issue modules can connect to external trackers and synchronize remediation work in both directions. Users host their own graph database, with Neo4j and Memgraph listed as options. Analysis can use deterministic queries, single-agent AI acceleration, or multi-agent LangGraph workflows. The open-source edition runs on user-controlled infrastructure and can operate fully offline without cloud calls. The maker says models, data, and findings remain on that infrastructure, and that there is no background telemetry or usage-data transmission. The GUI is aimed at security teams; the CLI supports DevOps, CI/CD automation, and threat-model-as-code. Open Source is free; Enterprise is self-hosted with contract pricing and dedicated support.